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TITLE 

METHOD AND APPARATUS FOR INTEGRATED WIRELESS 
COMMUNICATIONS IN PRIVATE AND PUBLIC NETWORK 
5 ENVIRONMENTS 

Background of the Invention 

The present invention is a method and apparatus that provides for wireless 
calls in private network environments and in public network environments. More 
10 particularly, this invention relates to communication systems that interconnect 
wireless networks with private networks where the private networks typically are 
corporate networks that connect to public networks such as PSTN, ISDN and the 
Internet. 

Conve ntional Cellular Systems 

15 Present day cellular mobile telephone systems provide for a large and 

increasing demand for mobile services. Cellular systems "reuse" frequency within 
a group of cells to provide wireless two-way radio frequency (RF) communication 
to large numbers of users. Each cell covers a small geographic area and collectively 
a group of adjacent cells covers a larger geographic region. Each cell has a fraction 

20 of the total amount of RF spectrum available to support cellular users. Cells are of 
different sizes (for example, macro-cell or micro-cell) and are generally fixed in 
capacity. The actual shapes and sizes of cells are complex functions of the terrain, 
the man-made environment, the quality of communication and the user capacity 
required. Cells are connected to each other via land lines or microwave links and 

25 to the public-switched telephone network (PSTN) through telephone switches that 
are adapted for mobile communication. The switches provide for the hand-off of 
users from cell to cell and thus typically from frequency to frequency as mobile 
users move between cells. 
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In conventional cellular systems, each cell has a base station with RF 
transmitters and RF receivers co-sited for transmitting and receiving 
communications to and from cellular users in the cell. The base station employs 
forward RF frequency bands (carriers) to transmit forward channel communications 
5 to users and employs reverse RF carriers to receive reverse channel communications 
from users in the cell. 

The forward and reverse channel communications use separate frequency 
bands so that simultaneous transmissions in both directions are possible. This 
operation is referred to as frequency division duplex (FDD) signaling. In time 
10 division duplex (TDD) signaling, the forward and reverse channels take turns using 
the same frequency band. 

The base station in addition to providing RF connectivity to users also 
provides connectivity to a Mobile Services Switching Center (MSC). In a typical 
cellular system, one or more MSCs will be used over the covered region. Each 
15 MSC can service a number of base stations and associated cells in the cellular 
system and supports switching operations for routing calls between other systems 
(such as the PSTN) and the cellular system or for routing calls within the cellular 
system. 

Base stations are typically controlled from the MSC by means of a Base 
20 Station Controller (BSC). The BSC assigns RF carriers to support calls, 
coordinates the handofF of mobile users between base stations, and monitors and 
reports on the status of base stations. The number of base stations controlled by a 
single MSC depends upon the traffic at each base station, the cost of 
interconnection between the MSC and the base stations, the topology of the service 
25 area and other similar factors. 

A handoff between base stations occurs, for example, when a mobile user 
travels from a first cell to an adjacent second cell. Handoffs also occur to relieve 
the load on a base station that has exhausted its traffic-carrying capacity or where 
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poor quality communication is occurring. The handoffis a communication transfer 
for a particular user from the base station for the first cell to the base station for the 
second cell. During the handoff in conventional cellular systems, there may be a 
transfer period of time during which the forward and reverse communications to the 

5 mobile user are severed with the base station for the first cell and are not 
established with the second cell. 

In time division multiple access (TDMA) systems, multiple channels are 
defined using the same carrier. The separate channels each transmit discontinuously 
in bursts which are timed so as not to interfere with the other channels on that 

10 carrier. Typically, TDMA implementations also employ FDMA techniques. Carriers 
are reused from cell to cell in an FDMA scheme, and on each carrier, several 
channels are defined using TDMA methods. The Global System for Mobile 
Communications (GSM), PCS 1900, IS- 13 6, and PDC standards are examples of 
TDMA methods in current use. 

15 The present specification uses a GSM system for purposes of explanation 

but the present invention applies to any wireless system protocol. 

GSM Cellular Systems 

The GSM system architecture is described, for example, in detail by M. 
20 Mouly and M.-B, Pautet, The GSM System for Mobile Communications, 1992 
and Mouly and M.-B. Pautet, GSM Protocol Architecture: Radio Sub-system 
Signaling, IEEE 41st Vehicular Technology Conference, 1991. The following 
sections highlight some unique aspects of GSM systems. 

The GSM system provides many advanced services, including: ISDN 
25 compatible supplementary services; Global roaming among GSM networks and 
other network types; advanced packet data services. 
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GSM System Architecture 

There is a very comprehensive set of GSM Specifications which define the 
three major components of any GSM network, namely, the Mobile Station (MS), 
Base Station Sub-System (BSS) and the Network Sub-System (NSS). 

Base Station Subsystem fBSS^ 

The Base Station Subsystem (BSS) is subdivided into two main entities, the 
Base Transceiver Station (BTS) and the Base Station Controller (BSC). The BTS 
includes the radio transceivers that define the radio cell and supports the radio (Urn) 
10 interface link to the mobile station. The BTS further supports the defined channel 
coding, encryption and speech coding functions. The BTS interfaces to the BSC via 
the Abis-interface. 

The Base Station Controller (BSC) manages the radio resources of multiple 
BTSs. The BSC controls all of the functions related to the radio network, including 
15 the allocation and release of radio resources and control of radio interface hand- 
overs. The BSC interfaces to the MSC via the A-interface. 

Network Subsystem 

The network subsystem (NSS) comprises four components these are, the 
20 Mobile services Switching Center (MSC), Home Location Register (HLR), Visitor 
Location Register (VLR), Authentication Centre (AuC) and the Equipment 
Identity Register (ETR). 

The main part of the network subsystem (NSS) is provided by the Mobile 
services Switching Center (MSC). The MSC provides the ability to track the 
25 mobile user, switch calls to/from the user to the PSTN/ISDN/PLMN (public land 
mobile network) and maintain contact with the mobile user via radio handovers. 
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The GSM PLMN (GSM public land mobile network) contains two database 
functions related to the mobility of the user these are the Home Location Register 
(HLR) and the Visited Location Register (VLR). 

The Home Location Register (HLR) is used by the operator to maintain 
5 data on all their subscribers. The subscriber data includes both fixed data, such as 
International Mobile Subscriber Identity (IMSI), subscriber MSISDN number and 
selected supplementary services, and dynamic data such as whereabouts of the 
mobile user and current settings for any supplementary services. Whenever a 
mobile users roanis into a new Visitor Location Register (VLR) area the HLR 
10 downloads the subscriber data to the VLR. The HLR is also required to deal with 
mobile terminating calls by routing the call to the correct VLR for further 
processing. 

The Visitor Location Register (VLR) is used as a local cache to store the 
subscriber data near the current location of the mobile user. Once the VLR has 
15 downloaded the subscriber data the mobile user can begin to use the services 
provided by the network. The process of downloading the user data and establishing 
a presence in a particular location is called roaming. 

In order to prevent fraudulent use of the network the GSM PLMN also 
contains two further databases the Authentication Centre (AUG) and the Equipment 
20 Identity Register (EIR). 

The Authentication Center (AUQ is a maintained in a secure 
environment since it contains the network authentication algorithms. The network 
uses this database to obtain data that is used to "challenge" the mobile user when 
they make an access to the network. The AUC uses two algorithms known as A3 
25 and A8, which are also stored in the Subscriber Identity Module (SIM) of the user. 
The A3 algorithm is used to authenticate the user by the familiar chanllenge 
response mechanism. The A8 algorithm is used to generate the required key for the 
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radio interface encryption algorithm know as A5. Generally the A3 and A8 
algorithms are developed by the network operators. 

The Equipment Identity Register (EBR) contains a list of all the valid 
International Mobile Equipment Identity (IMEI) values. Using the unique IMEI 
5 value associated with all mobiles it is possible restrict the use of specific mobiles. 
This database is used to prevent the use of stolen or misbehaving mobile stations. 
Operations and Maintenance 

Associated with the BSS and NSS equipment are Operations and 
Maintenance Centers, OMC-Rand OMC-S, respectively. The OMC-Rand OMC-S 
10 provide the following standard operations and maintenance control functions for 
the GSM BSS and NSS: 

Configuration Management 
Fault management 
Test Management 
15 Performance Management 

Security Management 
Account Management 
Other functions may be available depending upon the BSS or NSS manufacturer. 
In addition the OMC-S may also be required to perform database or user 
20 management functions on the HLR and VLR. 

Basic Services Provided bv GSM 

GSM was designed to be a feature rich mobile services with most services 
based upon ISDN principles. In basic terms the GSM provides a basic set of 
25 services which can be enhanced by the use of supplementary services. The Basic 
Services include: 
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Speech, the most basic service 

Short Message, a two way messaging service 

Group 3 FAX, this services allows connection to Group 3 FAX 
machines 

5 Cell Broadcast, this service allows messages to be broadcast to the 

mobile stations. 
The Bearer Services include: 

Asynchronous Data 300-14400 bps, allows access to normal V-Series 
Modems 

10 Synchronous Data 300-14400 bps, allows access to CSPDNs 

General Packet Radio Services 9600-170000 bps, a packet services 
allowing seamless access to the internet. 

The following GSM supplementary services are currently available: 
15 Call Forwarding 

Call Barring Services 

Call Transfer 

Conference Calling 

Call Wait and Call Hold 
20 Calling Line Identification 

Call Completion to a Busy Subscriber 

Problems with Private/Public cellular networks communicating MAP via IP 

In wireless systems, it is often necessary to exchange MAP information 
25 between the private and public cellular networks. In the case of modern voice over 
IP (VoIP) H.323 and other IP based networks, it is not possible to communicate 
using the cellular protocols such as Mobile Application Part (MAP) or A-interface 
protocol via SS7. Conversely, neither is it possible for the public system to 



-7- 



WO 00/28752 



PCT/US99/26375 



communicate using MAP or A-interface protocol with an H.323 or IP based 
network. 

In accordance with the above background, it is an object of the 
present invention to provide wireless systems that are compatible with conventional 
5 cellular systems and with corporate networks including local area networks and the 
Intranet. 

Summary of the Invention 

The present invention is a communication system formed by aprivate 
10 network that includes a private wireless network. The communication system also 
typically includes a public wireless network using a public wireless protocol, such 
as GSM, and typically includes public networks, such as PSTN, ISDN and the 
Internet, using a wired protocol, such as IP. The private network also typically 
includes a local area network (LAN) and the private network typically connects to 
15 the public networks using a wired packet protocol, such as IP. 

In the present invention, the public and private wireless networks 
operate with the same public wireless protocol, such as GSM, and the private 
wireless network additionally operates with a wired packet protocol, such as IP. 

The private wireless network uses private base stations (P-BTS) 
20 which include software for a wireless protocol, such as GSM, and include software 
for private network operation with a wired protocol, such as IP. 

The communication system pennits users to operate freely in both 
public and private wireless networks using standard mobile stations while achieving 
high private network data rates. The communication system typically uses normal 
25 wireless handsets or other mobile or fixed stations without need for any 
modifications. 

The private base stations (P-BTS) in one embodiment are directly 
connected to a private LAN and thereby enable standard wireless stations to make 
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and receive calls over the LAN. Also, the range of calls, using standard Internet 
protocols, extends between LANs and between different corporations over the 
Internet without requiring the support of a switch (e.g. MSC). The wireless stations 
can freely roam between the public wireless network and the private wireless 
5 network and a single telephone number can be assigned to a mobile station for use 
in both the public and the private wireless networks. 

The foregoing and other objects, features and advantages of the 
invention will be apparent from the following detailed description in conjunction 
with the drawings. 

10 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram representation of a communication system 
including a public wireless network, other public networks such as PSTN, ISDN 
and the Internet and including a private network. 
15 FIG. 2 depicts further details of the private network of FIG. 1. 

FIG. 3 depicts a GSMBTS architecture with added private network 

software. 

FIG. 4 depicts a LAN interconnection of private wireless base 
stations (P-BTSs). 

20 FIG. 5 depicts primary interface protocol stacks for IP-based private 

wireless base stations (P-BTS). 

FIG. 6 depicts a call processing plane of software modules for 
IP-Based private wireless base stations (P-BTS). 

FIG. 7 depicts an IP-based private wireless base station (P-BTS) 
25 gate keeper plane of software modules. 

FIG. 8 depicts IP-Based private wireless P-BTS OAM Software 

Modules. 

FIG. 9 depicts a Location Registration Procedure. 
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call. 



5 call. 



call. 



FIG. 1 0 depicts the first phase of processing a mobile originated call 
FIG. 1 1 depicts the second phase of processing a mobile originated 

FIG. 12 depicts the first phase of processing a mobile terminated 

FIG. 13 depicts the second phase of processing a mobile terminated 



FIG. 14 depicts a handover operation using wireless P-BTS. 
FIG. 15 depicts an Virtual Private Network (VPN) interconnection 
10 to GSM Public Land Mobile Network. 



DETAILED DESCRIPTION 
Communication System - FIG. 1 

In FIG. 1, the communication system 10 includes a conventional 
15 public wireless network 1 5, conventional public networks 8 (such as PSTN, ISDN 
and the Internet) and a private network 14. The public wireless network 15 
includes the ability to communicate in a conventional manner with conventional 
wireless mobile stations 4. The private network 14 includes the ability to 
communicate with the conventional mobile stations 4 and provides additional 
20 private network capabilities not provided by the conventional public wireless 
network 15. 

The conventional public wireless network 15 of FIG. 1 includes the 
mobile stations (MS) 4, Base Station Sub-System (BSS) 5 and the Network 
Sub-System (NSS) 6. The Base Station Subsystem (BSS) 5 is composed of the 
25 Base Transceiver Stations (BTSs) 12 and the Base Station Controller (BSC) 16. 
Each of the BTSs 12 includes a radio transceiver that defines the radio boundary of 
a cell 1 1 and handles the radio (Urn) interface protocols with the mobile stations 4. 
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The cell 1 1, in the wireless public network 15, of FIG. 1 each exist 
over a different area and together the cells 1 1 collectively exist over a larger area 
designated as a region 111. Each cell 1 1 in the region 1 1 1 uses frequencies that are 
isolated from the frequencies of other cells in the region. As mobile stations 4 travel 
5 from a present cell 1 1 to a next cell 11, a frequency handover occurs from the 
frequencies of the present cell 1 1 to the frequencies of the next cell 11. 

The private networks 14 of FIG. 1 include cells 1 V (including for 
example cells 11'- 1 and ll'-2) that each include a private P-BTS 27 for 
communications with mobile stations 4 located within the private networks 14. 
10 Also, any of the cells 11' can be sectorized so that different areas of a cell 1 V are 
partitioned into different sectors. For example, cell 11-2 has six sectors 11". 

The cells 1 1 ' and or sectors 11 ", are within the domain of the private 
networks 14 of FIG. 1, and also they are particular ones of the cells 1 1 of the public 
wireless network 15 ofFIG. 1 . In today's environment, the allocation of frequency 
15 spectrum in different regions is under governmental control and is allocated to 
different entities in different regions of a country. The owner of the rights to 
particular frequencies in a region including public network 1 5 and private network 
14 controls the allocation of frequencies among public cells 11, private cells 1 1' and 
sectors 11". 

20 The Base Station Controller (BSC) 1 6 manages the radio resources 

of one or more BTSs across ah Abis interface. The BSC 16 controls the radio 
network, including allocation of radio time slots to mobile stations 4, release of 
resources, interpretation of measurement results and control of radio interface 
handovers. The BSC 16 interfaces to the NSS 6 via an A-interface to MSC 17. 

25 The Network Subsystem (NSS) 6 includes the Mobile services Switching 

Center (MSC) 17 that provides the functions required to switch calls to/from the 
mobile stations 4 and the fixed public networks 8 (including PSTN and ISDN). In 
addition, the MSC 17 also provides the functions needed to track and maintain 
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communication with mobile stations 4 and these include registration, authentication, 
location updating, inter-MSC handovers, and call routing to roaming mobile 
stations 4. The GSM system employs a Home Location Register (HLR) 19 and a 
Visitor Location Register (VLR) 13, an Authentication Center (AUC) secure 
5 database 2 and an Equipment Identity Register (EIR) 3. The Operations and 
Maintenance Center includes the OMC-R 7 and the OMC-S 9. 

Private Networks - Fig. 2 

In FIG. 2, private networks 14 include private networks 14-1, 
10 1 4-N. Private network 14-1 is typical and includes the private wireless networks 22 
(including private wireless networks 22-1,..., 22-W), local area networks (LANs) 
24 (including LANs 24-1, 24-L), and connection units 29 (including connection 
units 29-1, 29-1). The private networks 14 can include wide area networks 
(WAN) and any other type of network presently or hereafter available. The 
15 connection unit 29 includes a hub 23 for interconnecting the private wireless 
networks 22 and the LANs 24 and for connecting the private network 14-1 to the 
public networks 8. The hub 23 connects to the router 33 that directs calls among 
the public network facilities including the ISDN 28, PSTN 26 and the Internet 
24 and the private networks 14. The private networks 14 use the same protocol as 
20 the Internet 25 and connect directly without need for a separate gateway. The 
connection unit 29 includes gateways 42-1, 42-2, 42-Gfor connecting the ISDN 
28, PBX 43, PSTN 26 which use different protocols than the private networks 
14. 

In FIG. 2, the private wireless networks 22 include the wireless 
25 capabilities of the public wireless network 15 of FIG. 1. In addition, the private 
wireless network 1 5 operates with advanced technologies that are not yet available 
publically. Current advanced technologies operate with rates of 384kb/s and are 
approaching rates of 2Mb/s. In FIG. 1 , wireless communications between the public 
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BTSs 12 and mobile stations 4 operate with a wireless protocol such as GSM. In 
FIG. 2, wireless communications between the private P-BTSs 27 and mobile 
stations 4 for convenience and comparability operate with the same wireless 
protocol (such as GSM) as used by the public BTSs 12 in the public wireless 
5 network 15. 

In FIG. 2, the local area networks (LANs) 24 are private wired 
networks operating with a wired packet protocol such as IP. LAN 24- 1 is typical 
and includes, for example, a server 25 and LAN terminals 21 (including terminals 
21-1, 21-T). Terminals 21-1, 21-T communicate with each other and with 

10 the public networks 8 through connection unit 29 using the wired packet protocol. 

In FIG. 2, the P-BTSs 27-1, 27-P are associated with protocol 
converters 28-1, 28-P, respectively, that connect P-BTSs 27-1, 27-P to 
connection unit 23 using the private network protocol used by the LANs 24 and the 
router 23 . Therefore, the mobile stations 4 communicating through the P-BTSs 27 

15 in the private networks 14 have access to the terminals 21 in LANs 24 and have 
access to the public networks 8. Further, the P-BTSs 27 in the private wireless 
networks 1 4 have available higher data rates than those available through the BTSs 
12 in the public wireless network 15. In the example described in the present 
specification, private rates up to 384kbps are possible whereas conventional public 

20 cellular networks only provide rates up to 64kbps. Accordingly, data retrieval 
operations in the private networks 14 are better accommodated than in the public 
wireless network 15 of FIG. 1. 

In FIG. 2, the wireless P-BTS 27 directly connect the mobile stations 
4 through router 23 to other facilities in private networks 14 and thereby permit, for 

25 example, the mobile stations 4 to send and receive calls to and from the terminals 
21 in the LAN networks 24- Furthermore, the range of calls from and to mobile 
stations 4 in the private wireless network 22, using standard Internet protocols (IP), 
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extends over the Internet in public networks 8 to any Internet facility such as 
different LANs and different corporations in different regions or countries. 

The private wireless networks 22 in FIG. 2 do not require the 
internal support of a circuit switch from the public networks and therefore, the 
5 private networks 1 4 in the FIG. 2 system can easily grow to accommodate new user 
requirements under control of the owners of the private networks 14. 

In the private networks 14 of FIG. 2, the mobile stations 4 are 
typically unmodified, conventional wireless mobile station handsets like those widely 
used in conventional public wireless networks and therefore the mobile stations 4 
10 can freely move between the public wireless network 15 of FIG. 1 and the private 
wireless networks 22 of FIG. 2 without restriction. Because of this free movement 
capability, only a single number is required for each mobile station 4 for both private 
wireless network communications and for public wireless network communications. 

The private wireless networks 22 of FIG. 2 have P-BTSs 27-1, 
15 27-P which corresond, for example, to the cells 1 1' and sectors 11" of FIG. 1 . The 
allocation of frequencies among the public wireless network cells 1 1, the private 
network cells 1 1' and the private network sectors 1 1" is determined by agreement 
of the owners of the public wireless network 15 and the private networks 14. 

20 GSM BTS Architecture - FIG. 3 

In a GSM example of the present invention, the FIG. 1 public 
wireless network 15 includes conventional GSM basestation software 31 as 
indicated in FIG. 3 including the components 31-1 and 31-2. The software 3 1 and 
components 31-1 and 3 1 -2 do not provide support for call control or connection to 

25 the private wired protocol (Internet Protocol) that is used in the private networks 
14 of FIG. 1 and FIG. 2. Accordingly, the software 3 1 and components 31-1 and 
31-2 require a protocol interface to facilitate interoperation of the wireless protocol 
and the wired packet protocol. For convinence, the protocol interfaces 28-1, 
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28-P are located with the P-BTSs 27-1, 27-P in the private wireless networks 
14 of FIG. 2 and are described in detail hereinafter. 

P-BTS Architecture Overview —FIG. 4 
5 The P-BTSs 27 are in the private wireless networks 14 ofFIG. 1 and 

FIG. 2 deployed, in one embodiment, as shown in FIG. 4. In this embodiment, each 
P-BTS 27 contains the required protocol stacks to perform the functions of the 
wireless control signaling from the mobile station 4 and the H.323 Endpoint, 
gatekeeper41 or gateway 42. In this embodiment, the H.323 Endpoint can be a PC 

10 based terminal 21 (see FIG. 2) or another mobile station 4. The gatekeeper 41 
provides the functions necessary to control the "terminals" within the H. 323 domain 
and, in this embodiment, "terminals" include GSM mobile stations 4. 

The H.323 gatekeeper 4 1 provides the functions required to register 
the mobile stations 4 (equivalent to Location Updating), permit access to the 

15- network, translation of called numbers and routing of calls, if required. These 
functions are largely equivalent to those normally found in the MSC 17 or HLR 19 
(see FIG. 1) of a public wireless network 15. The gatekeeper functions only need 
to exist in one P-BTS 27 of the P-BTS 27-1, P-BTS 27-2 and P-BTS 27-3 within 
the H.323 zone of FIG. 4. In the FIG. 4 example, P-BTS 27-3 provides the 

20 gatekeeper function within the H.323 zone of FIG. 4 and supports the operation of 
P-BTS 27-2 and P-BTS 27-1. 

In order to support the fall range of wireless functions, a the 
functions of a standard H.323 gatekeeper are augmented. The redesign includes the 
addition of a Local User Database (LUDB) 6-6 (See FIG. 6) to control the mobile 

25 station and provide Supplementary Services (SS) functionality. The gatekeeper 
database contents are transferred to the serving P-BTS when the mobile station 4 
registers (that is, Location Updating has taken place) on a P-BTS. For example, 
if a mobile station 4 has registered on P-BTS 27-1 in FIG. 4 and the user data of 
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mobile station 4 is stored with the gatekeeper 41 supported by P-BTS 27-3, then 

the relevant contents of the user database in P-BTS 27-3 are transferred to P-BTS 

27-1 when the registration takes place. Any updates or alterations to the data by 

interaction of mobile station 4 are reflected back to the main gatekeeper database 
5 7-3 stored in the gatekeeper 41 (See FIG. 7). This approach reduces the amount 

of call control signalling that is required within a LAN and provides redundancy for 

increased reliability. 

In order to provide external PSTN or public wireless network 

interconnection, an H.323 gateway 42 is provided in FIG. 4. The gateway 42 is part 
10 of the normal VoIP LAN-PSTN operation. The gateway 42 provides line interface 

and transcoding functions that allow the voice and data traffic to be sent to existing 

networks (for example, PSTN, ISDN, B-ISDN, PBX). 

An additional function required of a P-BTS 27 when used in a LAN 

environment of FIG. 4 is the ability to control the handover of mobile stations 4 
15 between different P-BTSs 27 as mobile stations 4 move around within the LAN 

zone serviced by the private networks 14 of FIG. 4 and FIG. 2. The handover 

decision is made internally within each P-BTS 27, only the signaling necessary to 

command a handover needs to go between the P-BTSs 27. 

20 Protocol Stacks for Signaling - FIG. 5 

To support the architecture, the standard GSM stack 3 1 of FIG. 3 
is modified by the P-Network Software 32 as shown in the FIG. 5. In FIG. 5, the 
components 31-1' and 31-2* are equivalent to the components 31-1 and 3 1 -2 in FIG. 
3. As can be seen from FIG. 5, in addition to the private Wireless Air Interface 
25 requirements and the H.323 Terminal Equipment requirements, the LAN based 
P-BTS 27 also provides the following functionality: 

Interworking between the two Call Control Functions - 
private wireless and LAN based 
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Private Wireless Mobility Management (there is no BSC or 
MSC in stack 31 of FIG. 3). 
The Call Processing Plane Software Modules are significantly more 
complicated than those found in a normal public BTS and are defined in FIG. 6. 



10 



Call Processing Plane Software Modules for IP-Based P-BTS -TIG, 6. 

In FIG. 6, the software modules for the call processing plane include 
modules used for IP-based operation of P-BTSs 27 as follows: 

Call Control Module - The module 6- 1 is responsible for the "call 
feature control" function for the mobile station, including 
both basic Call Control (CC) as well as Call Related 
Supplementary Services (CRSS). The CRSS handled by this 
module include: 

Calling Line Identification Presentation 



15 



20 



25 



(CLIP) 
(CLIR) 
(COLP) 
(COLR) 



Calling Line Identification Restriction 

Connected Line Identification Presentation 

Connected Line Identification Restriction 

Call Fonvarding Busy (CFB) 

Call Forwarding No Reply (CFNR) 

Call Forwarding Unconditional (CFU) 

Call Waiting (CW) 

Call Hold (HOLD) 

Multi-Party Service (MPTY) 
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The Call Control Module is not merely an 
"interworking between the private Wireless Call Control and 
ISDN Call Control messages." It is required to carry out the 
feature control functions, such as connecting voice path, 
5 providing tones and announcements when call is not 

answered, working with Private gatekeeper entity in the 
local zone to obtain appropriate resource (e.g. conference 
circuit), forwarding a call, and managing call waiting and 
call hold features. 

10 Tone and Announcement Module - The module 6-2 handles the 

actual generation of the various tone and announcement 
used according to the Call Control based on different call 
handling situation. Tone and Announcement are usually 
played towards the "far-end" this will be the LAN direction 

15 in this case, where only a tone is played toward the local 

Mobile Direction. 
Mobility Management Module - The module 6-3 is responsible 
for handling the Mobility Management Function of the 
mobile station, including location update and handover 

20 control/co-ordination. This function was originally located 

in the private wireless MSC and is fulfilled in the IP-based 
P-BTS. It also provides the ability to find a terminating 
mobile station and the ability to handle the call when the 
mobile station moves from one P-BTS to another P-BTS. 

25 System Control Module - The module 6-4 is responsible for the 

End-Point registration, Administration, and status reporting 
in LAN. This entity is the "end-point" function and does not 
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cover the gatekeeper functions which may be resident on the 
same P-BTS as well. 
CISS Controller Module - The module 6-5 controls all the Call 
Independent Supplementary Services (CISS) for the mobile 
5 station that is registering through or served by the current 

P-BTS. The services include: 

Subscriber activation/deactivation of various 
supplementary features, such as call waiting, 
call hold, call forwarding, etc. 
10 Subscriber programming of the supplementary 

Service, such as the forwarded-to number 
when the mobile station is busy. 
Most of the CISS features are of the interrogation 
type with the subscriber setting information 
15 in the domain user database. This module is 

responsible for updating the local user 
database(LUDB), while the LUDB is 
responsible for ensuring the changes are 
carried back to the domain user database (an 
20 HLR like database in the gatekeeper) 

correctly. 

Local User Database Module (LUDB) - The module 6-6 
maintains a copy of user data for each of the mobile stations 
that is registered on the current P-BTS. The data is stored 
25 in local memory as a "cache." Any changes to the local copy 

will be "written -back" to the domain user database 
automatically. All the other modules who need the user data 
to operate interact with the Local User Database module for 
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the data interrogation: The Local User Database 

Module will interact with the Domain User Database 
Module when necessary and does it in a way that is 
transparent to all the other modules in the P-BTS. 

RIL3-CC Encoder/Decoder Module - The module 6-7 is 
responsible for encoding and decoding the GSM Radio 
Interface Layer3 Call Control messages. 

RIL3-MM Encoder/Decoder Module -The module 6-8 is 
responsible for encoding and decoding the GSM Radio 
Interface Layer3 Mobility Management messages. 

H.225.0 RAS Encoder/Decoder Module - The module 6-9 is 
responsible for encoding and decoding the H.225.0 
Registration Administration and Status (RAS) messages. 
This module is shared between Call Processing Plane and 
the gatekeeper Plane. 

H.225.0 CC Encoder/Decoder Module - The module 6-10 is 
responsible for encoding and decoding the H.225.0 Call 
Control messages. The H.225.0 Call Control Message is 
based on ISDN Q.931 Message Set. 

H.245 Encoder/Decoder Module - The module 6-11 is 
responsible for encoding and decoding the H.245 messages. 
The H.245 specification defines a set of messages for 
controlling the allocation and management of the logical 
channels for multimedia applications. 

RRM Module - The module 6-12 is responsible for the entire 
Radio Resource Management functionality that is normally 
split between the BTS and the BSC in the traditional 
architecture. The RRM Module will directly interface with 
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the Call Control Module for radio resource functions, such 
as channel set-up, paging, etc. 
RIL3 Message Delivery Module - The module 6-1 3 is responsible 
for looking into the protocol discriminator field in the 
5 layer-3 message header to determine which module has to 

process this message. The delivery of the CC message will 
now be sent to the RIL3-CC Encoder/Decoder Module, and 
the MM message to the RIL3-MM Encoder/Decoder 
Module. 

10 SMS-PP Controller Module - The module 6-14 is responsible in 

handling the Point-to-Point SMS messages that are to be 
delivered to the target mobile station. 
SMS-CB Controller Module - The SMS-CB module 6- 1 5 is used 
to keep track of the functionality of receiving and 

15 distributing the SMS CB messages that are to be broadcast 

by all or part of the P-BTSs within the current H.323 Zone. 
Frequency Hopping Control Module - The module 6-16 controls 
the frequency of communications for the target mobile 
station. 

20 RBL3-KR Encoder/Decoder Module - The module 6-17 decodes 

and encodes the RIL3-RR messages to and from the BTS 
internal RR message formats. The formats of the RIL3-RR 
messages are specified in the GSM Technical Specification 
04,08 along with the KJ0L3-MM, EJL3-CC, RIL3-SS, and 

25 RIL3-SMS messages specifications. This module provides 

the encoding and decoding of the RTL3-RR message which 
is required for the P-BTS. 
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BTS Power Control Module - The module 6-1 8 is responsible for 
providing the P-BTS power control (down-link) both 
statically and dynamically. The P-BTS Power Control 
Module takes the Mobile Uplink Measurement Data that is 
5 sent from a mobile, that is in dedicated mode, and compiled 

to provide the best power adjustment strategy for the given 
mobile. The goal is to maintain the P-BTS power in the 
optimal level so that the signal strength and signal quality for 
the down-link signal is within the private wireless quality 
10 guideline without causing excessive interference to the 

adjacent cell sites that are using the same or adjacent 
frequencies. 

MS Power Control Module - The module 6- 1 9 interfaces with the 
Channel Encoding and Decoding to add/retrieve the power 

15 control information into/out-off the header fields of the 

Layer 1 messages. The retrieval of the Mobile's up-link 
power level and the encoding of the command to instruct 
Mobile Station to increase/decrease the output power 
should be separated from the intelligence of performing 

20 sliding window algorithm over Mobile's power level and 

making decision to increase or decrease the MS power level. 

BTS Measurement Report Module - The module 6-20 interfaces 
with GSM burst processing components to obtain the P- 
25 BTS measurement of the Mobile uplink signal. Specifically, 

the Automatic Gain Control and Demodulator for uplink 
power-level, and the Channel decoding unit for signal 
quality. Depending on the actual hardware architecture the 
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input may come from more than just the three components 
identified above. 

Timing Advance Module - The module 6-21 interfaces with the 
Burst Format function and retrieves the burst delay 
5 information for the Mobile, and then interfaces with the 

Channel Encoding and Decoding to add the Mobile timing 
advance information into the layer- 1 header field. The 
Timing Advance Module can be treated as part of the 
Traffic Channel Processing Domain or as part of the Call 

10 Processing Domain. It autonomously monitors the delay of 

the arriving burst and instructs the burst formatting function 
to encode the amount of timing-advance that the mobile 
station needs to do in order to let the burst arrive within the 
burst envelope that the BTS is expected. 

15 LAPDn Module - The module 6-22 interfaces the message 

delivery to the channel coding/decoding. 

IP-based P-BTS Gate Keeper Plane Software Modules-FIG. 7 

In FIG. 7, the gatekeeper plane for gatekeeper 41 of FIG. 4 contains 
20 the modules which realize the wireless gatekeeper functionality as well as a 
combined Local/Domain User Database. Only one P-BTS 27 within each zone 
normally will have this plane activated. It is also possible to have the gatekeeper 4 1 
run in a dedicated mode without sharing the responsibility of a P-BTS function. 
Therefore, logical separation is maintained between the two entities even though 
25 they are expected to co-exist in the same hardware platform for many deployment 
scenarios. The IP-based P-BTS Gate Keeper Plane Software Modules include: 

Gatekeeper Module - The module 7-1 is responsible for the 
gatekeeper functionality as stated in theH 323 Specification. 

-23 - 



In one embodiment, the P-BTS may contain a gatekeeper 
entity along with an End-Point entity. Even though the 
gatekeeper is almost always consulted by the Call Control 
and System Control entities in the end-point, the above 
diagram does NOT show a direct connection among them. 
If all the entities are co-located in the same P-BTS, the 
traffic will actually go all the way to the IP layer, through 
the IP loop-back driver, and back to the correct entity. 
Domain User Database Module - The module 7-2 maintains the 
Mobile User's database for the "Home Zone." It is similar 
to the functionality provided by the GSM HLR, but without 
using GSM MAP for accessing the content of the database 
from the GSM MSC. The Domain User Database (DUDB) 
is responsible for communicating with the Local User 
Database Module (LUDB) to provide a "cached copy" of 
the user data when the mobile station performs a location 
update through the serving P-BTS. The Domain User 
Database Module will be responsible for informing the Local 
User Database Module about the changes to the user data 
when that happens. These include the delivery of 
Point-to-Point Short Messages to the mobile station, the 
update from the network operator in changing the 
subscription information of the mobile user, and Mobile 
User performs another location update. Changes can be 
triggered in reverse direction from the Local User Database 
to the Domain User Database, such as Mobile User 
performs a Call Independent Supplementary Service to 
program its supplementary services. In all cases, the Domain 
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User Database Module in the Gate Keeper only interacts 
with the User Local Database Module in the P-BTS and not 
the various Call Control or CISS Modules directly. 

Gate Keeper Database Module - The module 7-3 maintains the 
5 gatekeeper' s database regarding all the mobile stations in the 

same zone as well as information regarding other 
gatekeepers in the connected network. 

SMS-PP Controller Module - The module 7-4 is responsible in 
handling the Point-to-Point SMS messages that are to be 
10 delivered to the target mobile station. The module 7-4 is the 

same as the module 6-14 in the Call Processing Plane of 
FIG. 6. 

SMS-CB Controller Module - The SMS-CB module 7-5 is used 
to keep track of the functionality of receiving and 
15 distributing the SMS CB messages that are to be broadcast 

by all or part of the P-BTSs within the current H.323 Zone. 
The module 7-5 is the same as the module 6-15 in the Call 
Processing Plane of FIG. 6. 
H.225.0 RAS Encoder/Decoder Module - The module 7-6 is the 
20 same as the module 6-9 as described in the Call Processing 

Plane of FIG 6 . 

IP-Based P-BTS QAM Software Modules - FIG. 8 

The OAM Software Modules for the IP-Based P-BTS uses an 
25 SNMP based Management Information Base (MB). The new modules beyond 
those found in a normal public BTS are as follows: 

SNMP Protocol Stack Module - The module 8-1 is the SNMP 
protocol stack as used to control the SNMP MIB. 
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SNMP Agent - The module 8-2 provides the agent side code to 
perform the action request from the SNMP manager via the 
SNMP protocol. 

SNMP MIB Controller Module - The module 8-3 is responsible 
5 for maintaining the SNMP Mffi (a logical view, from 

maintenance perspective, for all the resources) for the P- 
BTS. The remote OAM commands from, for example an 
OMC-R are all carried out via changes to the MIB. The 
MLB controller than interprets the changes and performs the 
10 maintenance actions. Alarm and Performance reports from 

the P-BTS will also be collected and stored in the MIB. 
This module handles all the SNMP MIB, including 
additional configuration and controlling attributes for the 
H.323 aspects of the P-BTS. Furthermore, the CC and MM 
15 functionality and RR functionality is also managed by this 

module. 

Initialization and Task Control Module - The module 8-4 is 
responsible for handling the initialisation of all the other 
Software Modules, establishing communication, and 
20 monitoring the health of all these processes through heart- 

beat (keep-alive timer) mechanisms. 

Network Operations 

25 This section describes several scenarios to demonstrate how an 

Intranet-based P-BTS 27 using the modules described above and deployed as shown 
in FIG. 4 provides the same type of services that are normally provided by a public 
cellular system that is based upon the conventional GSM architecture. The 
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following scenarios are representative of those required for the support of cellular 
service and other scenarios can be constructed from these building blocks. 
Mobile Terminal Registration (Location Updating) 
Private Terminal in Private Domain 
5 Private Terminal in Public Domain 

Public Terminal in Private Domain 
Private Mobile Originated Call to: 

Private Mobile or Fixed Terminal Located in Private Domain 
Private Mobile or Fixed Terminal Located in Public Domain 
10 Public Mobile Located in Private Domain 

Public Mobile or Fixed Terminal Located in Public Domain 
Mobile Terminated Call from: 

Private Mobile or Fixed Terminal Located in Private Domain 
Private Mobile or Fixed Terminal Located in Public Domain 
15 Public Mobile Located in Private Domain 

Public Mobile or Fixed Terminal Located in Public Domain 
Handover within the LAN based P-BTS network. 
It has been assumed in all the scenarios described below that the P-BTS 
handling the call has already performed the required registration phase with its 
20 "local" wireless gatekeeper 41 entity(See FIG. 4). It should also be noted that the 
P-BTS 27 handling the call may also be another P-BTS acting as the gatekeeper 
within the domain. 

In the scenarios described below the following assumptions and definitions 
are used: 

25 A Private Network in the cases described below is a network based 

upon the P-BTS running with the modules described above. 
The user data for the mobile stations is located in the private 
network gatekeeper 41 (See FIG. 4). 
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A Private Network Operator is considered to be the owner (for 
example corporation or other entity) of the private network 
including the P-BTS units. It may be that the private 
wireless network is managed by the public network operator 
with guidance from the private network owner. 

A Private Mobile is a wireless station that is serviced by the private 
network. The mobile station is also permitted to roam into 
the domain service by the public wireless network depending 
upon agreements between the operator of the public wireless 
network and the owner of the private network. 

A Private Fixed Terminal is a terminal that is located on the LAN 
or attached PBX that is fixed in location. This may also be 
a normal fixed PBX phone or a phone attached to a desktop 
PC. 

A Public Network is a normal public wireless network under the 
control of a licensed operator. The network contains the 
usual cellular entities such as MSC, VLR or HLR. 

A Public Wireless Station is a wireless station that is primarily 
located on the cellular public wireless network. The mobile 
wireless station may also be permitted to roam into the 
private wireless domain depending upon agreements 
between the operator of the public wireless network and the 
owner of the private network. The user data for this mobile 
user is located in the Public Network operators HLR. 

A Public Network Operator is considered to be the licensed owner 
of a public wireless network into which the domain of the 
private wireless network falls as related to the relevant 
spectrum. 
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In the cases described below, it is assumed that the mobile station 4 is a 
standard wireless station that need not have been modified. In such a case, the 
wireless station is a subscriber, having an Identity Module (SIM) card to identify the 
subscriber and contains a unique International Mobile Equipment Identity (IMEI). 
5 In the descriptions below, it is assumed that the "network" is capable of 

performing number translations that allow calls to reach the private network 
gateway 42 (See FIG. 4) or the relevant public cellular network. This assumption 
implies that the wireless station number is unique within the national numbering 
plan. 

10 

Mobile Terminal Registration 

The registration operation needs to be performed for three different 
scenarios: 

Private Terminal in the Private LAN Zone. 
15 Private Terminal in the Public Wireless Network 

Public Terminal in the Private LAN Zone. 
Within each of these scenarios there are several variations that may be 
considered. In particular, one of the major items that will impact the operation of 
the private network is the varying registration requirements that may be placed on 
20 the private mobile station 4. In each of the sections below, the possible options are 
discussed in terms of the differences between the private network procedure and/or 
the normal public cellular network procedure. 

Private Terminal Registration in the Private EL323 Zone 
25 The terminal registration phase in the private LAN network is designed to 

appear identical to that found in a Public Wireless Network as far as the Private 
mobile station is concerned. In order to accomplish this operation, the P-BTS is 
required to broadcast, on the Broadcast Control Channel (BCCH), the same type 



-29- 



WO 00/28752 



PCT/US99/26375 



of information as is found in a "normal" public wireless network 15. When the 
terminal detects and decodes the broadcast channel information, it can then perform 
the usual registration function as shown in FIG. 9. The registration function in this 
case would be terminated at the wireless gatekeeper database. As an alternative, 
5 the wireless gatekeeper can also contact a Public HLR database to retrieve the User 
data for use by the P-BTS. 

The signaling between the P-BTS and P-BTS/gatekeeper function uses the 
standard H.323 Registration Request (RRQ) message sequence. If the RRQ 
sequence fails, then a Location Reject messages is used to terminate the procedure 
10 with the mobile station. The sequence shown in FIG. 9 is made up of a number of 
phases as follows. 

Phase 1: This phase is the normal Location Update request made by the 
mobile station when it detects its Private (home) network. In this 
case the Mobility Management (MM) layer in the P-BTS will 

15 terminate the signaling for this message. 

Phase 2: When the MM receives the Location Update request it must 
initiate a registration with the private wireless gatekeeper. In order 
to perform this operation H.323/RAS signaling is used to send a 
Registration Request (RRQ) to the private wireless gatekeeper. The 

20 RRQ message will contain the IMSI of the registering mobile 

station, Call Signal, RAS and H.245 Transport Addresses for the 
P-BTS. 

If the IMSI associated with the Private mobile station is 
already registered with this serving P-BTS then the registration, as 
25 an option, need not be checked with the gatekeeper. However in 

this case it would be more usual to expect an "IMSI attach" rather 
than a Location Update request. 
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If the TMSI security option is to be used within the Private 
domain then on first registration it will be necessary to retrieve the 
IMSI if the Location Area Identifier (LAI) is not recognized by the 
P-BTS receiving the Locate Update request. 
Phase 3: When the gatekeeper receives the RRQ it will check that the IMSI 
(or TMSI+LAI) presented in the RRQ is permitted to register on the 
Private Network. This function allows the Private Network 
Operator to control access to the network. It is possible to enable 
or disable access to the network for Private or Public network users. 
After checking the IMSI the private wireless gatekeeper may take 
several actions dependent upon how the system has been 
configured. 

If the IMSI belongs to a Private mobile station and the user 
data for that mobile station is located in the gatekeeper database 
then the gatekeeper can return a Registration Confirmed (RCF) 
message to the requesting P-BTS. If the Private mobile station is 
already associated with another address (e.g. another P-BTS) then 
the gatekeeper can perform an Unregister Request 
(URQ/UCF/URJ) sequence to the old P-BTS address in order to 
eliminate duplicate information. It should be noted that this 
operation sequence for the H.323 stack is unique to this 
implementation of the Invention. 

If the IMSI belongs to a Private mobile station and the user 
data for the mobile is not located in the gatekeeper then the 
gatekeeper requests the information for this user from another 
gatekeeper located elsewhere within the Private network. This 
requires the transfer of data to this gatekeeper before the processing 
can continue as described above. 
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If the IMSI belongs to a Public mobile station or to a Private 
mobile station required to use the Public HLR then the gatekeeper 
requests the relevant database information from the Public Network 
HLR via a suitably modified Private wireless gateway. The Private 
5 to Public gateway in this case takes the internal H. 3 23 signaling and 

translate that into Private wireless specific signaling for interworking 
with the Public Network HLR. In this case the data is relayed to the 
serving P-BTS. It also possible that the Public Network HLR will 
reject the request in which case the Location Update request from 

10 the Mobile User must also be rejected. If the HLR accepts the 

request then it must store the E.164 number of the "gateway" in 
order to deal with Mobile Terminated Calls. 
Phase 4: After the registration phase has been completed the data must be 
transferred from the Private wireless gatekeeper to the Serving 

15 P-BTS . In FIG. 9 this is shown by the TFTP message, however this 

is only used as an example other techniques could be used 
dependent upon the amount of data to be transferred. If small 
amounts of data are to be moved then it could be added to the RCF 
message or an new message could be used based on the H.323 "Non 

20 Standard Message" option. The exact option used does not affect 

the outcome required by this invention. 
Phase 5: Once the data has been transferred to the serving P-BTS the 
registration procedure can be completed to the mobile station. 
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Location Registration Procedure - FIG. 9 

In FIG. 9, the private mobile station registration in Public GSM PLMN is 
depicted. The exact method used to register the private mobile station in the Public 
Network will depend upon the network configuration. Two options are described 
5 below where it is assumed that the private mobile station is permitted to register in 
the Public Network. 

Private Network Database: If the user data is held in a Private Network 
database on the Private wireless gatekeeper, as outlined above, then 
when the Private mobile station registers in the Public Network the 
10 serving MSC will have to access this database via the gateway 

function. The Private wireless gatekeeper will retain the MSC 
and/or YLR Number in this case for use with Mobile Terminating 
Calls. 

Public Network Database: If the user data is held in the Public Network 
15 HLR, then the registration procedure is as per a normal GSM 

registration procedure. 
Public mobile station Registration in the Private H.323 Zone: In the 
case of the Public mobile station registering in the LAN zone, the 
Private wireless gatekeeper interrogates the Public Network HLR 
20 that is the home location for the public mobile station. 

Mobile Originated Call - FIG. 10 and FIG. 11 

Four variations of the Mobile Originated Call (MOC) need to be considered 
and these are MOCs which is directed to: 
25 Private Mobile or Fixed Terminal Located in Private Domain 

Private Mobile in Public Domain 
Public Mobile Located in Private Domain 
Public Mobile or Fixed Terminal Located in Public Domain 
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The Mobile Originated Call (MOC) case is the most difficult in terms of 
determining the destination of the call and how it is to be routed. The sections 
below detail how this route determination is to be undertaken. 

5 Mobile Originated Call to Private Mobile or Fixed Terminal Located in 

Private Domain 

A Private Mobile User making a Mobile Originated Call would see the call 
procedure as "identical" to the procedure found in a normal public Wireless 
Network, the call flow is illustrated in FIG. 10 and FIG. 11. The signalling 
10 between the P-BTS and Private wireless gatekeeper function would use the 
standard H.323 message sequences. The call flows shown in FIG. 10 and FIG. 1 1 
is made up of a number of phases: 

Phase 1: This phase is the normal CM Service request made by the mobile 
station when it wishes to make a Mobile Originated Call. In this 
15 case the Mobility Management (MM) layer in the P-BTS will 

terminate the signalling for this message. 
Phase 2: The normal call establishment now continues with the mobile 
station sending a SETUP message including the Called Party 
Number (CPN). The Connection Management (CM) layer is 
20 responsible for initiating the call into the network. 

Phase 3: The CM layer will begin the access process in the H.323 stack by 
using the RAS Admission Request (ARQ) sequence towards the 
P-BTS/gatekeeper. The purpose of this sequence is to both locate 
the terminating party and request LAN bandwidth for use in the call. 
25 In a small or isolated network the ARQ sequence may be redundant, 

however it would permit easy co-existence when the P-BTS resides 
in more heavily loaded networks, it would also allow the gatekeeper 
to easily apply QoS procedures to the P-BTS. The ARQ generated 
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by the P-BTS will contain the CPN. The CPN number is used by 
the gatekeeper to determine the process to be followed in 
establishing the call. The exact process may be operator specific 
and is not described in this invention. 

The required routing information for the H.323/Q.931 
SETUP message can be returned to the serving P-BTS in the ACF 
message. If the information cannot be resolved or other checks on 
the originating party fail then the call sequence may be rejected at 
this point and the call terminated. 
Phase 4: Upon receipt of the ACF the serving P-BTS can now route the 
H.323 SETUP message to the destination. It should be noted that 
the destination may apply call forwarding or other forwarding 
operations. As soon as the H.323 Call Proceeding is received the 
CM layer can proceed with the call processing towards the mobile 
station. 

Phase 5: When the H.323 Call Proceeding message has been received by 
the H.323 stack establishment of the audio channel can begin. This 
is undertaken by the Terminal Capabilities, Master/Slave and 
Bi-Directional Channel Open (B-OpenChn) sequence. This will 
allow conversation as soon as the mobile station has been assigned 
to a radio Channel, thereby avoiding any speech clipping problems. 

Phase 6: The completion of the call will begin with the sending of a Call 
Proceeding message to the mobile station. This can then be 
followed by an assignment of the mobile station to the traffic 
channel (TCH). The Alerting and Connect sequence are then used 
to complete the call establishment process. 

In establishing this call it has been assumed that the terminating party is 
either a Private mobile station or Private Fixed Terminal within the same H.323 
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area. In this case, the Terminal Capabilities negotiation process takes care of 
selecting the correct code. 

In FIG. 10 and FIG. 11, the operation of a Mobile Originated Call to a 
Private mobile station Located in Public Domain is represented. If the Mobile 
5 Originated Call is to another Private mobile station which is now registered on the 
Public Domain, there are two possible options depending upon how the user data 
is stored in the network. If the user location data is stored by the Private wireless 
gatekeeper, then the addresses necessary to route the call will be returned in the 
ACF, which should point to the Public MSC/VLR serving the Private mobile 

10 station. If the user location data is stored in the Public Cellular network HLR then 
the gatekeeper will either have to request the location data from the Public HLR or 
simply route the call directly to the gateway then to the nearest MSC. Therefore 
the routing data for the call will be provided directly by the HLR or indirectly via 
the MSC. In all of these cases the H.323 SETUP message will be routed to the 

15 gateway entity for routing to the external network. In this case it will also be 
necessary to use the transcoding functions of the gateway entity. 

Public Mobile Located in Private Domain 

If the Mobile Originated Call is to Public Mobile which is now registered on . 

20 the Private Domain there are two solutions depending upon how the user data is 
stored in the network. If the Public user location data is stored by the Private 
wireless gatekeeper, this pointer is used to "short circuit 1 ' the need to interrogate the 
Public HLR and the addresses necessary to route the call is returned in the ACF, 
which points to the P-BTS serving the Public mobile station. In this case, the H.323 

25 SETUP message is routed directly to the P-BTS serving the Public mobile station. 

If the user location data is stored in the Public HLR, then the Private 
wireless gatekeeper requests the location data from the Public HLR. This operation 
provides the routing data for establishing the call via the H.323 gateway. In this 
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case, the gateway is responsible for determining the location of the Public User. 
Therefore, in practice, the scheme mentioned in the previous paragraph is optimum 
in terms of signalling performance since the gatekeeper only needs to interrogate the 
Public HLR if the Public mobile station cannot be found in the Private Network. 

5 

Public Mobile or Fixed Terminal Located in Public Domain 
If the Mobile Originated Call is to a Public mobile station or Fixed Terminal 
located in the Circuit Switched Telephone (CST) domain, then the routing of the 
call is directly to the gateway. However it may be that in order to speed up the 
10 establishment of the call, the Private wireless gatekeeper will search for the CPN on 
the Private Network first before routing the call to the gateway. The gateway is 
then responsible for signalling and providing the necessary transcoding functions. 

Mobile Terminated Call - FIG. 12 and FIG. 13 
15 The Mobile Terminated Call needs to be performed for four different 

scenarios: 

Private Mobile or Fixed Terminal Located in Private Domain 
Private Mobile or Fixed Terminal Located in Public Domain 
Public Mobile Located in Private Domain 
20 Public Mobile or Fixed Terminal Located in Public Domain 

The Mobile Terminated Call (MTC) case is the most straightforward call 
scenario. In most of the above cases, the call flows are identical; the only difference 
being the terminating point and the signalling required to reach that point. 

25 Private Mobile or Fixed Terminal Located in Private Domain to Private 

Mobile 

This case covers two scenarios, calls from another fixed computer terminal 
using H.323 and calls from another Private mobile station. In both of these cases, 
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the call flows are identical, once the destination address of the Private mobile station 
has been determined. The call flows shown in FIG. 12 is made up of a number of 
phases: 

Phase 1: The initial phase of a Mobile Terminated Call establishment is 

5 started by the arrival of the H.323 SETUP message from the calling 

party on the well known Q.931 Signaling address in the P-BTS. 
The CPN number in the SETUP message is then used to lookup up 
paging information for the Private mobile station. The H.323 Call 
Proceeding message is returned to the originating endpoint. 

10 Phase 2: The normal Paging request is now made to the mobile station 

when the Private Network wants to make aMobile Terminated Call. 
When the mobile responds to the Page Request the normal 
Authentication and Ciphering procedures can be performed. During 
this time it should be possible for the RAS layer to begin the ARQ 

15 sequence with the registered gatekeeper in order to reserve the 

required bandwidth. 
Phase 3: The GSM call establishment procedures now continue with the 
mobile station receiving a SETUP message including the Bearer 
Capabilities for the call being established, this is required to make 

20 sure the mobile station can correctly determine the type of call. For 

example, an MTC Data call may require a modem to be enabled in 
the mobile station. When the Call Confirmed message is received 
from the mobile station then the H.323 stack can then proceed with 
the LAN part of the call. 

25 Phase 4: When the H.323 stack receives the Call Confirmed message from 

the mobile station the H.245 layer should begin the necessary 
Terminal Capabilities, Master/Slave and Bi-Directional Channel 
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Open (B-OpenChn) sequence in order to establish the RTP/RTCP 
transport link between the endpoints. 
Phase 5: In this phase the mobile station can now return the Alerting and 
Connect messages which are forwarded to the originating endpoint 
5 in the Private Network. Upon receipt of the CONNECT message 

the CM layer can request the assignment of the required radio 
resources. 

In establishing this call it has been assumed that the terminating party is 
either a Private mobile station or Private Fixed Terminal within the same H.323 
10 area. In this case, the Terminal Capabilities negotiation process takes care of 
selecting the correct code. 

The call release scenario is also given in FIG. 13. 

Private Mobile or Fixed Terminal Located in Public Domain 
15 In the case of a Fixed Terminal Circuit Switched Telephone (CST) call to 

a Private mobile station on the private network, the call is first routed to the nearest 
H.323 gateway by the PSTN/ISDN network (this may depend on local regulations). 
The gateway will then be required to interrogate its local Private wireless 
gatekeeper, which may have to interrogate other gatekeepers, in order to find the 
20 required routing information. Once the routing information has been returned, then 
the call can be established through the Intranet to the terminating P-BTS. 

Public Mobile Located in Private Domain 

In the case of a Public mobile station located in the Private Network the first 
25 requirement is to locate the destination address of the called mobile. This would 
involve the serving P-BTS interrogating its registered Private wireless gatekeeper 
to determine the routing address. Once the routing address has been determined the 
call can be routed to the terminating mobile. 
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Public Mobile or Fixed Terminal Located in P ublic Domain 
In the case of a Fixed Terminal CST call to a Private mobile station on the 
private network the call is first routed to the nearest H.323 gateway by the 
PSTN/ISDN network (this may depend on local regulations). The gateway will 
5 then be required to interrogate its local Private wireless gatekeeper, which may have 
to interrogate other Private wireless gatekeepers, in order to find the required 
routing information. Once the routing information has been returned then the call 
can be established through the Intranet to the terminating P-BTS. 

10 Handover Operation With P-BTS - FIG, 14 

In FIG. 14 details of a handover operation are shown. The handover 
scenarios fall into the following categories: 

Intra-Private Network Handover. 
Inter-Private Network Handover 
15 Private to Public Network Handover 

Public to Private Network Handover 
The first two cases are dealt with in the next section as they are very similar. 
The last two cases are not described in detail since they can be built from the first 
two. 

20 Intra-Private Network Handover Inter-Private Network Handover 

In order to provide continuous coverage within the private domain 
(Intranet), it is necessary to be able to perform at least intra-domain and 
inter-domain handovers. In order to simplify the implementation of the network, 
the P-BTS performs the handover candidate calculations on the measurement data 

25 being sent by the mobile station. Once a handover candidate has b een identified and 
the decision made, then the process to begin the handover needs to be started. 
There are several methods used to facilitate the.handover process. The simplest 
solution is to use this conference facilities of H.323 and the resources of the 
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gatekeeper/Multi-Conference Unit (MCU) to bridge the old P-BTS and the target 
P-BTS. Another method uses the multicast options of the Intranet to send the 
uplink and downlink IP packets to both the old and new P-BTSs. In either case, the 
target P-BTS enables the new radio interface, prepares to take over the mobile 
5 station Call Control state machine and establishes the necessary routing to access 
the network. Once the new radio channel has been established, the terminal is 
instructed to move to the new P-BTS and the old P-BTS resources are released. 
If each P-BTS used a different LAI, then location updating (registration) is 
automatically performed when the call terminates. In performing the handover as 
10 shown in FIG, 14, the following phases are undertaken: 

Phase 1: Once the handover algorithm has determined that a handover is 
required then the transport addresses of the new base station must 
be determined. The new base station address is determined by 
making use of the RAS Location Request with the BTS ID as the 
15 addressed party. When appropriate this operation is extended to 

include the locations of BTSs within the Public GSM network. 
Phase 2: If the gatekeeper knows the transport addresses of the Target 
BTS (EP3) then it is returned in the Location Confirm (LCF) 
message. At this point the Old BTS (EP1) must request the 
20 resources from the Target BTS . The resource request is performed 

by adding a new "Non-Standard Message" to the H.323 repertoire. 
This hew message requests the resources from the Target BTS. 
This message may also include call control information appropriate 
to this mobile station. In addition, to speed up the location updating 
25 process, it may also include the Old BTSs copy of the user data. 

In the case of a handover to the Public network then the 
M Non-Standard Message" would have to be sent to the gateway and 
converted into the appropriate Handover message for the public 



-41- 



WO 00/28752 PCT/US99/26375 



network. The gateway would also have to start handling the call for 
theOldBTS. 

Phase 3: When the Target BTS receives the request for the resources, if 
they are available then it will respond with a confirmation and a 
5 multicast address to be used by the Old BTS. 

Phase 4: Upon receiving the confirmation the Old BTS begins to establish 
a conference between the destination BTS (EP2) or Fixed Terminal 
and the Target BTS. Once the multicast distributed conference has 
been established the Old BTS can instruct the mobile station to 
10 handover to the Target BTS . 

Phase 5: The Handover Command is sent to the mobile station which will 
then begin to access the Target BTS on the indicated timeslot. 
Once the mobile station is established on the Target BTS an End 
Session message is sent to the Old BTS to release the resources 
15 from the BTS. The Call Control is now located on the Target BTS. 

In order to accommodate different handover cases, the P-BTS determines 
via the BTS ID whether Synchronized or Non-synchronized handover is to be used. 
It should be noted that this procedure is equally applicable to both Private 
and Public mobile stations. This procedure also forms the basis for any scheme 
20 which requires handover to/from the Public GSM network. 

VPN Interconnection To GSM PLMN - FIG. 15 

In FIG, 15, a P-BTS Virtual Private Network (VPN) 34 formed by the P- 
BTSs 27-1, 27-2 and 27-3' interconnects to GSM PLMN 26 through hub 23 and 
25 router 33 to the Internet 24. In FIG. 15, the wireless gatekeeper 41* is part of the 
P-BTS 3 27-3 \ The gatekeeper 4 1 'communicates with the Public Cellular HLR 1 9 
using a reduced form of the normal Public Wireless Cellular Signaling system. The 
HLR 19 can then be contacted using the Internet over a dedicated trunk line from 
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a gateway. The trunk lines connect the H.323 gateway to the MSC and then to the 
HLR 19. At the HLR 19, an IP SS7 translator is used, to convert the incoming 
control signalling riding on IP to be sent over SS7 and vice-versa. In order to 
efficiently support private/public roaming, the IP to S S7 translation entity is best co- 

5 located with the Public Cellular Network HLR 19, where it can be used to service 
many private networks such as networks 14-1, 14-M as well as private network 
14-1 in FIG. 15. Using this scheme, Public-to-Private and Private-to-Public 
roaming is easily performed. The IP/SS7 translator is available from many 
manufacturers. This function is also used to transport Short Messages to and from 

10 the Private/Public domain. 

The support of handover is achieved with the addition of handover support 
in the gateway entity and an IP-to-SS7 convertor co-located with the nearest MSC. 
This addition allows handover messages to be passed to and from the MSC, via the 
H.323 gateway and then to the serving P-BTS. 

15 

While the invention has been particularly shown and described with 
reference to preferred embodiments thereof it will be understood by those skilled 
in the art that various changes in form and details may be made therein without 
departing from the scope of the invention. Some terms used in the specification are 
20 set forth in the following GLOSSARY. 
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GLOSSARY 

ALS Alternate Lines Selection 

ARS Automatic Route Selection 

CAR Call Detail Record 

5 CC Call Control 

DHCP Dynamic Host Configuration Protocol 

DNS Domain Name Server 

GoIP GSM over IP 

GSM Global System for Mobile Communications 

10 HTML Hyper Text Markup Language 

IMEI International Mobile Equipment Identity 

IMSI International Mobile Subscriber Identity (based on E.212 



numbering) 

IrDA 
15 ISDN 

Java 

LAI 

LCR 

MEB 
20 MM 

MS 

MSIDN 
NNTP 
OAM 

25 

PDA Personal Digital Assistant 

PLMN Public Land Mobile Network 

RR Radio Resource 



Infra red Digital Access 
Integrated Services Digital Network 
Programming language from Sun MicroSystems 
Location Area Identifier 
Least Cost Routing 
Management Information Base 
Mobility Management 
Mobile station 

Mobile station ISDN Number 
Network Time Protocol 
Operations, Administration, & Maintenance 
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SMS - CB Short Message Service - Cell Broadcast 

SMS -PP Short Message Service - Point-to-Point 

SNMP Simple Network Management Protocol 

SNTP Simple Network Time Protocol 

5 TMSI Temporary Mobile Subscriber Identity 

VPN Virtual Private Network 
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CLAIMS 

1 LA communication system having 



2 a private network including, 

3 a private wireless network operating with a wireless protocol for 

4 communications with wireless stations, 

5 a private wired network operating with a wired packet protocol for 

6 communications with terminals, 

7 connection means for interconnecting the private wireless network 

8 and the private wired network, 

9 interface means for interfacing the wireless protocol and the wired 

10 packet protocol whereby wireless stations operating with the 

11 wireless protocol communicate with the wired packet 

12 protocol. 



1 2. The communication system of Claim 1 wherein said wireless protocol is GSM. 

1 3. The communication system of Claim 1 wherein said wired packet protocol is 

2 Internet Protocol. 

1 4. The communication system of Claim 1 wherein said private wired network 

2 includes one or more local area networks and said private network includes 

3 connection means for connecting the private wireless network to said local area 

4 networks. 

1 5 . The communication system of Claim 4 wherein said connection means connects 

2 the private wireless network and said private wireless network to public networks 
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3 whereby said wireless stations communicate with said public network through said 

4 private network. 

1 6. The communication system of Claim 5 wherein said public networks include the 

2 Internet, PSTN and ISDN. 

1 7. The communication system of Claim 1 wherein said private wired network 

2 includes connection means for connecting the private wireless network to said local 

3 area networks and to the public networks whereby said wireless stations operating 

4 in said private wireless network communicate with said public network through said 

5 private network. 

1 8. The communication system of Claim 1 further including public networks and a 

2 public wireless network wherein, 

3 said public wireless network uses said wireless protocol whereby said 

4 wireless stations communicate in said public wireless network and 

5 said private wireless network, 

6 said private wired network includes one or more local area networks and 

7 said private network includes connection means for connecting the 

8 private wireless network to said local area networks and to the 

9 public networks whereby said wireless stations operating in said 

10 private wireless network communicate with said public network 

11 through said private network and whereby said wireless stations 

12 operating in said public wireless network communicate with said 

13 wireless terminals through said private network. 
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1 9. The communication system of Claim 1 wherein private wired network includes 

2 one or more local area networks and said private network includes connection 

3 means for connecting the private wireless network to said public wireless network. 

1 10. The communication system of Claim 9 wherein said wireless stations and said 

2 terminals have integrated voice and data operations. 

1 11. The communication system of Claim 1 further including a public wireless 

2 network using said wireless protocol whereby said wireless stations communicate 

3 in said public wireless network and said private wireless network. 

1 12. The communication system of Claim 11 wherein said wireless stations 

2 communicate at data rates of the public wireless network when communicating over 

3 the public wireless network. 

1 13. The communication system of Claim 11 wherein said wireless stations 

2 communicate at data rates of the private wireless network when communicating 

3 over the private wireless network. 

1 14. The communication system of Claim 13 wherein said wireless stations 

2 communicate at data rates of 384Kb/s over the private wireless network. 

1 15. The communication system of Claim 1 1 wherein said public wireless network 

2 includes apublicBSC, apublicMSC and a public HLR for wireless stations making 

3 calls using said public wireless network. 
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1 16. The communication system of Claim 15 wherein said wireless stations do not 

2 require use of said public BSC, said public MSC or said public HLR for calls using 

3 said private wireless network. 

1 17. The communication system of Claim 1 wherein said wireless protocol is GSM 

2 and has a wireless call build/teardown sequence and said wired packet protocol 

3 includes H.225, H.245 and H.323 and has a wired packet call build/teardown 

4 sequence and wherein said interface means integrates said wireless call 

5 build/teardown sequence with said wired packet call build/teardown sequence. 

1 18. The communication system of Claim 1 wherein said private wireless network 

2 includes one or more wireless cells and said private wireless network includes 

3 control means for controlling which ones of said cells service which ones of the 

4 wireless stations. 

1 19. The communication system of Claim 18 wherein said control means includes 

2 handover means for controlling handover of wireless stations from one of said cells 

3 to other of said cells. 

1 20. The communication system of Claim 1 wherein said private wireless network 

2 includes location means for sensing locations of wireless stations and includes 

3 private location database means for storing the locations of wireless stations. 

1 21. The communication system of Claim 20 wherein said private location database 

2 means is accessable by said public networks. 

1 22. The communication system of Claim 1 wherein said private wireless network 

2 includes one or more private base transceiver stations, each private base transceiver 
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3 station establishing wireless communication, using said wireless protocol, with said 

4 wireless stations located in a cell within a the private network. 

1 23. The communication system of Claim 1 wherein said private wireless network 

2 includes a plurality of private base transceiver stations, each private base transceiver 

3 station establishing wireless communication, using said wireless protocol, with said 

4 wireless stations located one or more cells within the private network, and wherein 

5 said connection means includes a hub for connecting said plurality of private base 

6 transceiver stations together in a local area network. 

1 24. The communication system of Claim 23 wherein said local area network 

2 includes gatekeeper means for providing control functions for operation of the 

3 wireless stations according to the private wired packet protocol 

1 25. The communication system of Claim 24 wherein said gatekeeper means 

2 includes, a gatekeeper, a gatekeeper database and an encoder/decoder for 

3 registration, administration and status messages. 

1 26. The communication system of Claim 23 wherein said local area network 

2 includes a router for providing control functions for routing calls between the 

3 private network and the public networks. 

1 27. The communication system of Claim 26 wherein said public networks include 

2 PSTN, ISDN and Internet networks. 
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1 28. The communication system of Claim 27 wherein said connection means 

2 includes one or more gateways for providing control functions for the wireless 

3 stations for converting the wired packet protocol to a public network protocol for 

4 said PSTN and ISDN networks. 

1 29. The communication system of Claim 28 wherein said public network protocol 

2 is a PSTN protocol. 

1 30. The communication system of Claim 28 wherein said public network protocol 

2 is an ISDN protocol. 
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